1. Creating the users and user groups

Go to User & Device > User > User Groups and create separate user groups for web-only and full-access portals.

Add a user (in the example, ckent) to the user group for full-access SSL VPN connections.

2. Configuring the SSL VPN realms

3. Configuring the SSL VPN tunnel

Go to VPN > SSL > Settings and set Listen on Interface(s) to wan1.

Set Listen on Port to 10443 and Specify custom IP ranges in the SSLVPN_TUNNEL_ADDR1 range.

Under Authentication/Portal Mapping, add the SSL VPN user groups created previously.

Add the WebOnlyGroup to the web-access portal, and add the FullAccessGroup to the full-access portal.

Set the Realm accordingly for each portal mapping.

4. Configuring the multi-realm SSL VPN policy

Go to Policy & Objects > Policy > IPv4 and add a security policy allowing access to the internal network.

Set Incoming Interface to ssl.root.

Set Source Address to all and add the Source User groups you created.

Set Outgoing Interface to the local network interface so that the remote users can access the internal network.

Set Destination Address to all, enable NAT, and configure any remaining firewall and security options as desired.

5. Results – Testing the web portal

To begin, use your web browser and navigate to the SSL VPN web portal for the web-only access group. In this case, the portal is located at
https://172.20.121.56:10443/web. 

Attempt to log into this portal first using the web-only user dprince. Log out after a successful attempt. Note how Tunnel Mode does not appear for the web-only user.

Upon logging out, attempt to connect to this portal again using the full-access group user ckent. Permission should be denied.

Next, attempt to log into the full-access portal, in this case located at
https://172.20.121.56:10443/full.

If you attempt to log in with user dprince, permission should be denied.

Log in successfully with user ckent. Tunnel Mode is now active with a successful connection.

Note that Tunnel Mode does not work on Google Chrome. If Tunnel Mode does not successfully connect, and you are using a compatible browser, you may need to update your FortiClient plugin.

Log out when you are satisfied with the full-access portal.

6. Results – Testing the FortiClient tunnel

Open FortiClient and begin by creating a new SSL VPN tunnel.

Set Remote Gateway to the Internet-facing interface on the FortiGate.

Set Customize port to 10443 and Apply your changes.

7. Results – Logging and monitoring

8. Troubleshooting

If you’re having difficulty with this configuration, you can attempt to troubleshoot the SSL VPN. 

Go to System > Dashboard > Status and enter the commands shown here using the CLI Console and then attempt to connect to the tunnel.

diagnose debug disable
diagnose debug reset
diagnose debug application sslvpn -1
diagnose debug enable

1. Enabling the FortiGate modem interface

The modem configuration is hidden in the FortiGate GUI by default. Enter the CLI commands shown on the right to enable it. 

Log in and out to refresh the GUI page.

config system modem
 set status enable
end

2. Viewing the supported modem lists

1. Enabling the FortiGate to show FortiExtender configurations

Enable the Control And Provisioning of Wireless Access Points (CAPWAP) on the port which the FortiExtender is connected to. This allows the FortiExtender to communicate with the FortiGate using CAPWAP. Enter the following CLI commands:

config system interface
 edit [port]
  append allowaccess capwap
end

The FortiExtender configuration is hidden in the FortiGate GUI by default. Enter the following CLI commands to enable it:

config system global
 set fortiextender enable
 set wireless-controller enable
end

2. Authorizing the FortiExtender

3. Viewing the supported modem lists

Go to Network > FortiExtender select Configure Settings.

Select Supported Modems to go to the supported modem lists.

Click the FortiGuard button to get the latest version of the supported modem lists, and then select the plus button to expand either list.

1. Configuring FortiClient EMS

In the FortiClient EMS Dashboard, go to Endpoints > Domains and select the Add a new domain button.

In the Domain Settings window, enter the Active Directory server information.

Test the connection, and then select Save.

Select the new domain in the Domains list to view the Client Details and FortiClient Information.

Go to View > Settings.

Enter and confirm a FortiHeartBeat Connection Key and enable Scan Local Workgroups. Make note of the FortiHeartBeat Connection Key.

Also note the FortiClient Download URL.

Save your changes.

2. (Optional) Importing Endpoint Profiles into FortiClient EMS

3. Enabling and enforcing FortiHeartBeat on the FortiGate

On the FortiGate, go to Network > Interfaces and edit the internal interface.

Under Restrict Access, enable FortiHeartBeat.

Scroll down to Admission Control and enable Enforce FortiHeartBeat for all FortiClients.

4. (Optional) FortiClient installer configuration

With the above configuration, devices on the internal network that aren’t registered with FortiClient are presented with an Endpoint Security Required page that includes a download link to the FortiClient application on the FortiGate. You can customize the FortiClient download installer link to use the EMS installer link instead.

On the FortiGate, go to System > Replacement Messages, switch to the Extended View, and edit the Endpoint Control replacement message for the appropriate endpoints.

You can also customize the installer itself in FortiClient EMS.

Go to View > Software Manager and +Add a custom installer.

Configure the installer as desired, then select Save.

5. Results

When a device on the internal network that isn’t registered with FortiClient attempts to connect to the Internet, or access other services behind the FortiGate, the user of that device is presented with an Endpoint Security Required page that includes a download link to the FortiClient application.

When the user downloads and installs FortiClient, they are prompted for registration. 

Enter the Registration Key and select Accept.

Note that the Registration Key matches the FortiHeartBeat Connection Key entered in Step 1.

The FortiClient then registers to the FortiGate (or FortiClient EMS, depending on the installation) and downloads a configuration update from FortiClient EMS.

The registered endpoint now has access to the Internet and network services as defined by NAC and policy enforcement on the FortiGate.

The registration information and FortiClient profile configuration can be verified in the FortiClient window.

To view the details of registered endpoints on the FortiGate, go to one of the following:

FortiView > Sources
(Double-click the item in the list to drill down to greater detail.)

User & Device > Device List

Monitor > FortiClient Monitor

1. Creating a new CA on the FortiAuthenticator

On the FortiAuthenticator, go to Certificate Management > Certificate Authorities > Local CAs and create a new CA.

Enter a Certificate ID, select Root CA certificate, and configure the key options as shown in the example.

Once created, highlight the certificate and select Export.

This will save a .crt file to your local drive.

2. Installing the CA on the network

Internet Explorer and Chrome

In Windows Explorer, right-click on the certificate and select Install Certificate. Open the certificate and follow the Certificate Import Wizard.

Make sure to place the certificate in the Trusted Root Certification Authorities store.

Finish the Wizard, and select Yes to confirm and install the certificate.

Firefox

In the web browser, go to Options > Advanced > Certificates and select View Certificates.

In the Authorities tab, select Import.

Find and open the root certificate.

You will be asked what purposes the certificate will be trusted to identify. Select all options, and select OK.

3. Creating a CSR on the FortiGate

On the FortiGate, go to System > Certificates and select Generate to create a new certificate signing request (CSR).

Enter a Certificate Name, the Internet facing IP address of the FortiGate, and a valid email address, then configure the key options as shown in the example.

Once created, the certificate will show a Status of Pending. Highlight the certificate and select Download.

This will save a .csr file to your local drive.

4. Importing and signing the CSR on the FortiAuthenticator

Back on the FortiAuthenticator, go to Certificate Management > End Entities > Users and import the .csr certificate created earlier.

Make sure to select the Certificate authority from the dropdown menu and set the Hash algorithm to SHA-256, as configured earlier.

Once imported, you should see that the certificate has been signed by the FortiAuthenticator, with a Status of Active. Highlight the certificate and select Export Certificate.

This will save a .cer file to your local drive.

5. Importing the local certificate to the FortiGate

Back on the FortiGate, go to System > Certificates and select Local Certificate from the Import dropdown menu.

Browse to the .cer certificate you just created. Select Open and then select OK.

You should now see that the certificate’s Status has changed from Pending to OK. You may have to refresh your page to see the status change.

6. Configuring the certificate for the GUI

Go to System > Admin > Settings.

Under Administration Settings, set HTTPS server certificate to the certificate created/signed earlier, then select Apply.

7. Results

Close and reopen your browser, and go to the FortiGate admin login page. If you click on the lock icon next to the address bar, you should see that the certificate has been signed and verified by the FortiAuthenticator. As a result, no certificate errors will appear.

1. Creating a CSR on the FortiGate

On the FortiGate, go to System > Certificates and select Generate to create a new CSR.

Enter a Certificate Name (Ramtops), the public IP of the FortiGate (172.20.121.92), and a valid email address.

Make sure to set Key Type to RSA and Key Size to 2048 Bit. This will ensure the certificate is securely encrypted.

Once created, the certificate Ramtops will show a Status of Pending. Highlight Ramtops and select Download.

This will save a .csr file to your local drive.

2. Creating an Intermediate CA on the FortiAuthenticator

On the FortiAuthenticator, go to Certificate Management > Certificate Authorities > Local CAs and select Import.

Set Type to CSR to sign, enter a Certificate ID, and import the Ramtops.csr file. Make sure to select the Certificate authority from the dropdown menu and set the Hash algorithm to SHA-256.

Once imported, you should see that Ramtops has been signed by the FortiAuthenticator, showing a Status of Active, and with the CA Type of Intermediate (non-signing) CA. Highlight the certificate and select Export.

This will save a .crt file to your local drive.

3. Importing the signed certificate on the FortiGate

Back on the FortiGate, go to System > Certificates and select Local Certificate from the Import dropdown menu.

Browse to the Ramtops.crt file and select OK.

You should now see that Ramtops has a Status of OK.

4. Configuring Application Control

Go to Security Profiles > Application Control and edit the default profile.

Under Options, enable Deep Inspection of Cloud Applications.

5. Configuring full SSL inspection

Go to Policy & Objects > Policy > SSL/SSH Inspection and create a new profile.

Enter a Name, select Ramtops from the CA Certificate dropdown menu, and make sure Inspection Method is set to Full SSL Inspection.

Next go to Policy & Objects > Policy > IPv4 and edit the policy that allows Internet access.

Under Security Profiles, enable SSL/SSH Inspection and select the ramtops profile created earlier.

Enable Application Control and set it to default.

6. Results

To test the certificate, open your web browser and attempt to navigate to an HTTPS website (in the example, https://www.dropbox.com).

If you click on the lock icon next to the address bar, you should now see that the certificate from the FortiGate (172.20.121.92) has signed and verified access to the site. As a result, no certificate errors will appear.

1. Registering the FortiGate as a RADIUS client on NPS

2. Creating a Connection Request Policy

3. Creating a Network Policy

4. Configuring FortiGate to use the RADIUS server

5. Configuring a user group on the FortiGate

6. Creating an SSID with RADIUS authentication

7. Creating a security policy

8. Results

1. Registering the FortiGate as a RADIUS client on NPS

2. Creating a Connection Request Policy

3. Creating a Network Policy

4. Configuring FortiGate to use the RADIUS server

5. Configuring a user group on the FortiGate

6. Creating an SSID with RADIUS authentication

7. Creating a security policy

8. Results

1. Configuring the IPsec VPN using the Wizard

Go to VPN > IPsec Wizard.

Name the VPN connection, set Template Type to Remote Access, select the Cisco Client remote device type, and select Next. 

Set Incoming Interface to the Internet-facing interface.

Select the Pre-shared Key authentication method and enter a pre-shared key.

Apply the appropriate User Group and select Next.

Set Local Interface to the internal interface and set Local Address to all.

Enter a Client Address Range for VPN users and select Create.

Disable split tunneling if you want all traffic (Internet and internal) to go through the IPsec VPN tunnel.

The VPN Creation Wizard provides a summary of created objects.

2. Creating a security policy for remote access to the Internet

Go to Policy & Objects > IPv4 Policy and create a new policy that allows remote users to securely access the Internet.

Set Incoming Interface to the newly created tunnel interface and set Outgoing Interface to the Internet-facing interface.

Set Source to all, Destination Address to all, Schedule to always, and Service to ALL.

Enable NAT and select OK.

3. Results

Select the Shared Secret authentication and enter the same pre-shared key that was entered in the IPsec VPN Wizard, then select OK.

Be sure to Apply your network configuration.

In the Network window on the Mac, select the VPN and select Connect.

You should now be able to browse the Internet and have access to the internal network.

1. Creating a local CA on FortiAuthenticator

The FortiAuthenticator will act as the certificate authority for all certificates authenticated for client access. To enable this functionality, a self-signed root CA certificate must be generated.

2. Creating a local service certificate on FortiAuthenticator

In order for the FortiAuthenticator to use a certificate in mutual authentication (supported by EAP‐TLS), a local services certificate has to be created on behalf of the FortiAuthenticator.

3. Configuring RADIUS EAP on FortiAuthenticator

In order for the FortiAuthenticator to present the newly created Local Services certificate as its authentication to the WiFi client, the RADIUS­‐EAP must be configured to use this certificate.

4. Configuring RADIUS client on FortiAuthenticator

The FortiAuthenticator has to be configured to allow RADIUS clients to make authorization requests to it.

5. Configuring local user on FortiAuthenticator

The authentication of the WiFi client will be tied to a user account on the FortiAuthenticator. In this scenario, a local user will be configured but remote users associated with LDAP can be configured as well.

6. Configuring local user certificate on FortiAuthenticator

The certificate created locally on the FortiAuthenticator will be associated with the local user. It is important to note that the Name (CN) must match the username exactly of the user that is registered in the FortiAuthenticator (i.e. eap‐user).

7. Creating RADIUS server on FortiGate

In order to proxy the authentication request from the wireless client, the FortiGate will need to have a RADIUS server to submit the authentication request to.

8. Creating WiFi SSID on FortiGate

In order for the WiFi client to connect using its certificate a SSID has to be configured on the FortiGate to accept this type of authentication.

9. Exporting user certificate from FortiAuthenticator

In order for the WiFi client to authenticate with the RADIUS server, the
user certificate created in the FortiAuthenticator must first be exported.

9. Importing user certificate into Windows 7

10. Configuring Windows 7 wireless profile to use certificate

On Smart Card or other Certificates Properties. Under When connecting, select Use a certificate on this computer, and check Use simple certificate selection. Click OK and click OK.

Please note, for simplification purposes, the Validate server certificate has been disabled but EAP-­‐TLS allows the client to validate the server as well as the server validate the client. To enable this, you will need to import the CA from the FortiAuthenticator to the Windows 7 computer and make sure that it is enabled as a Trusted Root Certification Authority.

The configuration for the Windows 7 computer has been completed and the user should be able to authenticate to WiFi via the certificate without using username and password.

11. Results on FortiAuthenticator

12. Results on FortiGate

1. Add FortiGate Devices and Map all Interfaces

Go to Device Manager, and add three FortiGate devices, by clicking Add Device. Follow the wizard to add each device.

Go to Policy & Objects > Policy Packages and define Zone interfaces.

Go to Device Manager and select a device.

Go to System: Interface and map interfaces to the Zone interfaces.

2. Create Firewall Address for Protected Subnets

Go to Policy & Objects > Object Configurations > Firewall Objects > Address to manage the firewall addresses.

VPN only supports firewall address with the type set to subnet (IP/Netmask). The firewall addresses will be used as protected subnets to generate static routes among the FortiGate devices.

3. Create a VPN Community

Go to VPN Manager > VPN Community list > Create New.

Set the VPN topology type to Full Meshed.

Define the authentication method with a pre-shared key.

Specify encryption and hash methods.

After defining authentication methods and encryption properties, click Next.

Configure VPN Phase 1 and Phase 2 settings.

For the IPSec Phase 2 setting, set the tunnel to Auto-Negotiate.

Optionally, under Advanced Options > the IKE version must be set to two in order to use IPv6 over tunnels.

VPN configuration summary:

4. Add VPN Gateway

Go to VPN Manager > VPN Community.

In the content pane, from the Create New menu, select Managed Gateway.

Add a Protected Network. There can be more than one protected networks.

Select a Device.

Select a default VPN interface. The default VPN interface should have a valid IP and mapped.

Optionally, specify the local gateway. This option can be left blank in most cases.

Routing > select Automatic to generate static routes.
If Manual is selected, go to the Device Manager to set the IP on the relevant IPSec interfaces and define the routings manually.

VPN gateway configuration settings summary:

5. Create Firewall Policies

Go to Policy & Objects > Policy Packages to create policies among the default VPN zones and protected-subnet interfaces.

Use the Install-On option to restrict policies applied on specific FortiGate devices.

Do not forget to create policies for bi-directional traffic.

1. Configuring the External FortiGate

In the Security Fabric, the External FortiGate is the root, or upstream, FortiGate. All the ISFW FortiGates will link to External in order to connect to other devices in the fabric, as well as the Internet.

In this example, the following interfaces on the External FortiGate are used to connect to other network devices:

• Port 9 connects to the Internet (this interface has already been configured)
• Port 10 connects to Accounting (IP address: 192.168.10.2)
• Port 11 connects to Marketing (IP address: 192.168.200.2)
• Port 12 connects to Sales (IP address: 192.168.35.2)
• Port 16 connects to the FortiAnalyzer (IP address: 192.168.55.2)

On External, go to Network > Interfaces and edit port 10.

Set an IP/Network Mask for the interface (in the example, 192.168.10.2).

Configure Administrative Access to allow FortiTelemetry, required for communication between FortiGates in the Security Fabric.

Configure other services as required.

Repeat this step to configure the other interfaces, setting the appropriate IP addresses.

Go to Policy & Objects > IPv4 Policy and create a policy for traffic from Accounting to the Internet.

Enable NAT.

Go to Policy & Objects > IPv4 Policy and create a policy allowing the ISFW FortiGates to access the FortiAnalyzer.

Do not enable NAT.

System > Security Fabric and enable Security Fabric. Set a Group Name and Password.

FortiAnalyzer logging is now enabled by default. Set IP Address to the FortiAnalyzer port 2’s IP (in the example, 192.168.55.10).

2. Installing the Accounting FortiGate

On Accounting, go to Network > Interfaces and edit wan1.

Set an IP/Network Mask for the interface that is on the same subnet as the External FortiGate’s port 10 (in the example, 192.168.10.10).

Configure Administrative Access to allow FortiTelemetry.

Edit the lan interface.

Set Addressing Mode to Manual and set the IP/Netmask to a private IP address (in the example, 10.10.10.1).

Configure Administrative Access to allow FortiTelemetry.

If you require the FortiGate to provide IP addresses using DHCP to devices that connect to this interface, enable DHCP Server.

Under Networked Devices, enable Device Detection.

Go to Policy & Objects > IPv4 Policy and create a policy to allow users on the Accounting network to access the Internet.

Because OSPF routing will be used, make sure NAT is not enabled.

Go to System > Security Fabric to add Accounting to the fabric. Enable Security Fabric, then enter the Group name and Group password set previously.

Enable Connect to upstream FortiGate and enter the IP of External’s port 10.

FortiAnalyzer logging is enabled by default. Settings for the FortiAnalyzer will be retrieved when Accounting connects to External.

If you have not already done so, connect Accounting’s wan1 port to External’s port 10.

3. Installing the Marketing and Sales FortiGates

Connect and configure Marketing using the same method as Accounting. Make sure to include the following:

• Configure wan1 to connect to the External FortiGate (example IP: 192.168.200.10)
• Configure the lan interface for the Marketing network (example IP: 10.10.200.1)
• Create a policy to allow users on the Marketing network to access the Internet
• Add the FortiGate to the Security Fabric

Connect and configure Sales, making sure to include the following:

• Configure wan1 to connect to the External FortiGate (example IP: 192.168.35.10)
• Configure the lan interface for the Sales network (example IP: 10.10.35.1)
• Create a policy to allow users on the Sales network to access the Internet
• Add the FortiGate to the Security Fabric

4. Configuring OSPF routing between the FortiGates

On External, go to Network > OSPF. Set Router ID to 0.0.0.1 and select Apply.

Expand the Advanced Options and set Default Information to Always, to make sure the default route is broadcast from External to the ISFW FortiGates.

In Areas, select Create New. Set Area to 0.0.0.0, Type to Regular, and Authentication to None.

In Networks, select Create New. Set IP/Netmask to 192.168.10.0/255.255.255.0 (the subnet that includes Accounting’s wan1) and Area to 0.0.0.0.

Create three additional entries, using the following IP addresses:

• 192.168.200.0/255.255.255.0 (Marketing)
• 192.168.35.0/255.255.255.0 (Sales)
• 192.168.55.0/255.255.255.0 (FortiAnalyzer)

Some FortiGate models, including the 90D and 51E used in this example, do not support configuring OSPF routing from the GUI. To add OSPF routing, use the following CLI command:

config router ospf
  set router-id 0.0.0.x
  config area
    edit 0.0.0.0
    next
  end
  config network
    edit 1
      set prefix x.x.x.0/255.255.255.0
    next
    edit 2
      set prefix x.x.x.0/255.255.255.0
    next
  end
end

5. Configuring the FortiAnalyzer

Go to Device Manager. The FortiGates are listed as Unregistered.

Select the FortiGates, then select +Add.

6. Running a Security Fabric Audit

The Security Fabric Audit is used to analyze your Security Fabric deployment to identify potential vulnerabilities and highlight best practices. Using the Audit helps you tune your network’s configuration, deploy new hardware and/or software, and gain more visibility and control of your network.

Also, by checking your Security Score, which is determined based on how many checks your network passes/fails during the Audit, you can have confidence that your network is getting more secure over time.

The Security Fabric Audit must be run on the root FortiGate in the Security Fabric (in this example, External).

On External, go to Log & Report > Security Fabric Audit.

All the FortiGates in the Fabric are shown. Select Next.

At the top of the page, you can see your Security Score, as well as the overall count of how many checks were passed or failed, with the failed checks divided by severity.

Further down, information is shown about each failed check, including which FortiGate failed the check, the effect on your score, and the recommendation to fix the issue.

Some recommendations may be listed as Easy Apply. To apply these changes, select Next.

By using Easy Apply, you can change the configuration of any FortiGate in the fabric, not just the root FortiGate.

Select all the changes you wish to make, then select Apply Recommendations.

7. Results

Also located on the Dashboard is the Security Fabric Score widget, which displays your current score.

If either of these widgets do not appear on your dashboard, they can be added using the Options button in the bottom right corner.

Go to FortiView > Physical Topology. This page shows a visualization of all access layer devices in the Security Fabric.

Security Fabric Audit recommendations are also shown in the topology, by the icon for the device the recommendations apply to.

Go to FortiView > Logical Topology. This dashboard displays information about the interface (logical or physical) that each device in the CSF is connected to.

Go to Monitor > Routing Monitor. You will see both ISFW FortiGates listed, using OSPF routing.

8. (Optional) Adding security profiles to the fabric

A Security Fabric configurations allow you to distribute security functions to different FortiGates in the fabric. For example, you may want to implement virus scanning on the External FortiGate but add application control and web filtering to the ISFW FortiGates.

This results in distributed processing between the FortiGates in the Security Fabric; reducing the load on each one. It also allows you to customize the web filtering and application control for the specific needs of the Accounting network as other internal networks may have different application control and web filtering requirements.

This configuration may result in threats getting through the External FortiGate which means you should very closely limit access to the network connections between the FortiGates in the fabric.

On External, go to Policy & Objects > IPv4 Policy and edit the policy allowing traffic from Accounting to the Internet.

Under Security Profiles, enable AntiVirus and select the default profile.

Do the same for the policies allowing traffic from the Marketing and Sales to the Internet.

On Accounting, go to Policy & Objects > IPv4 Policy and edit the policy allowing traffic from the Accounting Network to the Internet.

Under Security Profiles, enable Web Filter and Application Control. Select the default profiles for both.

Do the same on Marketing and Sales.

Go to Policy & Objects > Virtual IPs > Create New > Virtual IP. Enter a name for the VIP in the name box.

Set Interface to any.

Enter the External IP Address/Range and the Mapped IP Address/Range.

Enable Port Forwarding and specify the External Service Port and the Map to Port.

You can try to connect to the external server via the external IP and VIP from a computer on the external side of the firewall.

The connection is successful.

You can try to connect to the internal server via the external IP and VIP from a computer on the internal side of the firewall.

The connection is unsuccessful.

Go to Policy & Objects > IPv4 Policy > Create New. Enter a name for the policy in the name box.

Use the settings displayed in the graphic to create the policy.

Ensure that NAT is disabled.

In the CLI, enable the match-vip setting.

1. Connecting your ISPs to the FortiGate

Connect your ISP devices to your FortiGate so that the ISP you wish to use for most traffic is connected to WAN1 and the other connects to WAN2.

2. Modifying existing policies

You will not be able to add any interface to the SD-WAN interface that is already used in the FortiGate’s configuration. So, in this scenario, you must delete any security policies that use either WAN1 or WAN2, such as the default Internet access policy. Traffic will not be able to reach WAN1 or WAN2 through the FortiGate after you delete the existing policies.

It is also advisable to check for any other references to WAN1 or WAN2 and make the necessary modifications.

If you have many policies that reference WAN1 and/or WAN2, a simple method is to redirect those policies to unused ports, rather than delete them, to avoid having to recreate each policy from scratch. Obviously, you should redirect those same policies back to the SD-WAN interface once it is created.

Go to Policy & Objects > IPv4 Policy and delete any policies that use WAN1 or WAN2.

3. Creating the SD-WAN interface

Go to Network > SD-WAN.

Set the Interface State to Enable.

Under SD-WAN, add the two WAN interfaces.

Under Load Balancing Algorithm, select Volume and prioritize the WAN1 interface to serve more traffic.

In the example, the ISP connected to WAN1 is a 40Mb link, and the ISP connected to WAN2 is a 10Mb link, so we balanced the weight 75% to 25% in favor of WAN1.

To help visualize the effectiveness of the algorithm selected, the WAN Links Usage graph shows you the Bandwidth and Volume usage.

4. Configuring SD-WAN Status Check

You can optionally configure SD-WAN Status Check to verify the health and status of the links that make up the virtual WAN link.

This configuration uses the Ping protocol to verify the status of the SD-WAN.

Go to Network > SD-WAN Status Check and (if you wish to use Google) enter the values shown here.

5. Allowing traffic from the internal network to the SD-WAN interface

Go to Policy & Objects > IPv4 and create a new policy.

Set Incoming Interface to your internal network’s interface and set Outgoing Interface to the SD-WAN interface.

Enable NAT and apply Security Profiles as required.

Enable Log Allowed Traffic for All Sessions to allow you to verify the results later.

At this point, you should recover any policies that may have been redirected or deleted in Step 2 and point them to the SD-WAN interface.

6. Results

Browse the Internet using a computer on the internal network and then go to Network > SD-WAN > SD-WAN Usage.

You can see the bandwidth and volume of traffic traversing the SD-WAN interfaces.

Verify that Status Check is working by viewing the table at Network > SD-WAN > SD-WAN Status Check.

Go to Monitor > SD-WAN Monitor to view the number of sessions for each interface, bit rate, and more.

7. Testing failover

To test failover of the redundant Internet configuration, you must simulate a failed Internet connection to one of the ports. Do so by physically disconnecting the Ethernet cable connected to WAN1.

Verify that users still have Internet access by navigating to Monitor > SD-WAN Monitor. Note the Upload/Download of each WAN interface.

Furthermore, go to Network > SD-WAN > SD-WAN Usage to see that bandwidth and volume have diverted entirely through WAN2.

Users on the internal network should have no knowledge of the WAN1 failure. Likewise, if you are using the WAN1 gateway IP to connect to the admin dashboard, nothing should change from your perspective. It will appear as though you are still connecting through WAN1.

Reconnect the WAN1 Ethernet cable when you have verified successful failover.

1. Establishing the tunnel

If the tunnel is currently down, go to Monitor > IPsec Monitor, right-click the tunnel, and select Bring Up.

2. Capturing packets

Go to Network > Packet Capture and create a new entry.

Set Interface to the external-facing interface (in this case, wan1).

Select Enable Filters and enter Protocol 50 (the protocol number for ESP).

In the Packet Capture list, highlight the new entry and select Start/Resume Capturing to begin capturing packets for the next step.

Ping through the tunnel to populate the packet capture with traffic.

For example, in Windows Command Prompt, enter: ping x.x.x.x -n 100, where x.x.x.x is the remote tunnel endpoint (-n 100 will ping 100 times).

In the Packet Capture list on the FortiGate, select the Download option to save the .pcap file to your computer once the packets have been captured.

3. Configuring Wireshark

Go to Edit > Preferences and navigate to Protocol > ESP.

Check all BUT Attempt to detect/decode NULL encrypted ESP payloads.

Select Edit… to open the ESP SAs configuration table. 

On the FortiGate, open the CLI Console and enter the command diag vpn tunnel list.

Make note of the information next to dec: and enc:. You will need the SPI information, as well as the ESP and AH keys for both the remote and local FortiGates.

In Wireshark’s ESP SAs configuration table, add a new entry for each direction of the tunnel.

Note the image in the example:

• Src IP and Dest IP refer to the gateway addresses.
• The SPI information in the diag output will help you determine which encryption and authentication keys to use for each direction.
• Note that 0x must be prepended to the SPI entries as well as each of the Encyrption and Authentication Keys.

Click OK when you are done.

4. Results